PDF malware analysis — malicious · e6cb62ae1ccbf79e

MALICIOUS

PDF

49.6 KB Created: 2020-12-04 03:34:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: dec21c1535be4a7d118780d3ff0072e6 SHA-1: a8a1e0a147494ad769555ee2e794c5a3c4249c93 SHA-256: e6cb62ae1ccbf79ea5b8e351caec841010d11d9b7a67b7b4c9f1bfa0d86cdbf4

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains an embedded URL pointing to known malicious redirector infrastructure, which likely serves as a lure to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a theme related to 'Atticus the truth about magic'. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.5137

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/aws?utm_term=atticus+the+truth+about+magic+pdf
- https://cdn-cms.f-static.net/uploads/4387826/normal_5f9f9c5e0004d.pdf
- https://static.s123-cdn-static.com/uploads/4408596/normal_5fc6d6d9add03.pdf
- https://wifonofiwi.weebly.com/uploads/1/3/4/6/134636358/vudeteno.pdf
- https://cdn-cms.f-static.net/uploads/4481155/normal_5faf66433876b.pdf
- https://cdn-cms.f-static.net/uploads/4369640/normal_5f964516d61a3.pdf
- https://wimavebitajiki.weebly.com/uploads/1/3/4/6/134609796/jewinik.pdf
- https://xuwuperozaposa.weebly.com/uploads/1/3/2/3/132303395/numorevezisewuva.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4e8bcb3e0f577145ec53/1606373003929/24014501725.pdf
- https://static1.squarespace.com/static/5fbfff689955c744b536924c/t/5fc138421972c46e3ccab096/1606498370219/adblock_plus_apk_for_rooted_android.pdf
- https://static1.squarespace.com/static/5fc0d33427a199023ab4f616/t/5fc0ffb84e98326c0233efcd/1606483896870/drudgereport.com_rss_feed.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.